Skip to main content

DIRWALK

note

Only one collector is part of this template because the default settings will scan all files in the system and will take a long time for the job to complete and return results

This job template is designed to perform a directory walk of all files/folders on the target’s filesystem (excluding reparse points and network shares). This collection is more-so suited for baselining across multiple systems or searching through data for quick and easy-to-find IOCs.

Job Metadata
NameDIRWALK-TEMPLATE
Plugin Selection
📷 CollectorsCustom Plugins:
  • 262 - [📁Filesystem] Dirwalk (Win/Linux) (💾⌚)
Built-in Plugins:
⛙ Transports
  • WMI Transport (if Windows targets + credentials available)
  • SMB Transport (if Windows targets + credentials available)
  • SSH Transport (if *Nix targets + credentials available)
🔍 Analyzers
  • Elasticsearch Analyzer
Configuration Options
⛭ PickupMaximum Pickup File Size
job.pickup.maxsize		1 Gigabyte
Maximum Timeout
job.pickup.timeout		10 Minutes